1. Introduction

Coach Mode (“we,” “us,” “our”) operates the Coach Mode web application and related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.

We are committed to protecting your privacy and the privacy of the young athletes who use our platform. This Policy is designed to comply with the Children's Online Privacy Protection Act (“COPPA”), the California Consumer Privacy Act (“CCPA”), and other applicable privacy laws.

Please read this Privacy Policy carefully. By using the Service, you consent to the data practices described in this Policy. If you do not agree with this Policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Generated by the Service

2.3 Information Collected Automatically

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing the Service

• Authenticating your identity and managing your account.
• Processing and storing uploaded videos.
• Submitting videos to AI analysis and returning results.
• Displaying skill ratings, progress tracking, and coaching insights.
• Facilitating coach-student-parent relationships and data sharing.
• Generating lesson plans, drill recommendations, and development roadmaps.
• Sending transactional emails (account verification, invitations, notifications).

3.2 Improving the Service

• Analyzing usage patterns to improve features and user experience.
• Debugging errors and improving platform performance.
• Developing new features based on aggregated, de-identified usage trends.

3.3 Safety and Compliance

• Enforcing our Terms of Service and preventing abuse.
• Detecting and preventing fraud, security threats, and unauthorized access.
• Complying with legal obligations and responding to lawful requests.
• Maintaining audit logs for security events.

3.4 How We Do NOT Use Your Information

• We do NOT sell your personal information. Not now, not ever.
• We do NOT use your videos or personal information for advertising purposes.
• We do NOT use children's data for behavioral profiling or targeted advertising.
• We do NOT share your videos publicly. Videos are only accessible to authorized users (the student, their coach(es), and linked parents).
• We do NOT use your uploaded videos to train our own AI models. Videos are processed by our third-party AI provider (Google Gemini) solely for the purpose of generating your analysis. See Section 5 for details on AI data processing.

4. How AI Processes Your Video Data

4.1 AI Analysis Pipeline

When a video is uploaded to Coach Mode:

1. Upload: The video is uploaded to our secure cloud storage (Cloudflare R2) using a time-limited, pre-signed URL.
2. Submission to AI: The video (or a reference to it) is submitted to the Google Gemini API along with structured prompts that instruct the AI on what to analyze (strokes, movement, tactics, etc.).
3. Analysis Generation: Google Gemini processes the video and returns text-based analysis, including skill ratings, observations, strengths, areas for improvement, and recommendations.
4. Storage of Results: The text-based analysis results are stored in our database. The video itself is automatically deleted after 14 days.
5. Display: Analysis results are displayed to authorized users through the Coach Mode interface.

4.2 What Google Gemini Receives

When we submit a video for analysis, Google Gemini receives:

• The video file or a URL to access it.
• Structured prompts specifying what to analyze (these do not contain personal information beyond what is visible in the video itself).
• The student's pathway and skill level (e.g., “Junior Development, Orange Ball”) to calibrate analysis appropriateness.

Google Gemini does NOT receive: the student's name, email, date of birth, parent information, or any other personal identifiers.

4.3 Google's Data Practices

Our use of Google Gemini is subject to Google's API terms of service and data processing terms. As of the effective date of this Policy, Google's API data usage policies state that data submitted through paid API services is not used to train Google's models. For the most current information, please refer to Google's API Terms of Service and Google's Privacy Policy. We encourage you to review Google's policies directly, as they may change independently of this Policy.

5. Data Retention

5.1 Retention Schedule

5.2 Deletion Requests

You may request deletion of your data at any time by contacting us at privacy@coachmode.app or through your account settings. We will process deletion requests within 30 days. Note that:

• We may retain certain data as required by law (e.g., consent records for COPPA compliance).
• De-identified, aggregated data that cannot be linked back to you may be retained.
• Data that has been shared with or derived by third parties (e.g., AI analysis already generated) may not be fully recoverable.

6. Data Sharing and Disclosure

6.1 Sharing Within the Platform

Coach Mode shares data between users according to the following access controls:

6.2 Third-Party Service Providers

We share data with the following third-party service providers who process data on our behalf:

All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

6.3 Legal Disclosures

We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to:

• Comply with a legal obligation, subpoena, court order, or government request.
• Protect and defend the rights or property of Coach Mode.
• Prevent or investigate possible wrongdoing in connection with the Service.
• Protect the personal safety of users of the Service or the public.
• Protect against legal liability.

6.4 Business Transfers

If Coach Mode is involved in a merger, acquisition, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Service of any change in ownership or uses of your personal information.

7. Children's Privacy (COPPA Compliance)

Coach Mode takes the privacy of children very seriously. This section describes our practices specifically concerning children under 13.

7.1 What We Collect from Children Under 13

For managed student profiles of children under 13, we collect only the following information, which is the minimum necessary to provide the tennis coaching service:

• First name or initials (for identification within the coach-student relationship)
• Age or date of birth (to determine appropriate pathway and analysis calibration)
• Skill-level indicators (pathway, level, dominant hand, years playing)
• Video content depicting the child during tennis activities (uploaded by the coach, retained for 14 days only)
• AI-generated analysis results (skill ratings and feedback derived from video)

We do NOT collect from children under 13:

• Email addresses or other direct contact information
• Precise geolocation
• Photos (other than video uploaded by the coach for analysis)
• Social media identifiers
• Any data for advertising or behavioral profiling purposes

7.2 Parental Consent

Before any data is collected from or about a child under 13 through the Service:

• The child's coach or parent must complete our Digital Consent Form, which provides verifiable parental consent as required by COPPA.
• The consent form must be completed by the child's parent or legal guardian.
• We accept the following methods of verifiable parental consent:
  • Electronic signature with email verification to the parent's email address.
  • Knowledge-based verification (questions a child would be unlikely to answer).
  • Government-issued ID submission (for heightened consent scenarios).

7.3 Parental Rights Under COPPA

Parents and legal guardians of children under 13 have the right to:

• Review the personal information collected about their child by contacting us at privacy@coachmode.app.
• Request deletion of their child's personal information.
• Refuse further collection of their child's information, which may result in the child's managed student profile being deactivated.
• Revoke consent at any time by contacting us or through account settings.

We will respond to parental requests within 30 days.

7.4 Data Minimization for Children

We apply heightened data minimization principles for children under 13:

• Videos are retained for the minimum period necessary (14 days) and then automatically deleted.
• We do not retain video files for children under 13 beyond the analysis processing period.
• Analysis results are associated with a managed student profile (first name/initials only), not with an independently identifiable child account.
• We do not create persistent identifiers for children under 13 beyond the managed student profile ID.

7.5 Third-Party Disclosure of Children's Data

We do not disclose personal information collected from children under 13 to third parties except:

• To our service providers who process data on our behalf (see Section 6.2), under contractual obligations to protect such data.
• As required by law.

We do NOT disclose children's data for advertising, profiling, or any purpose unrelated to the tennis coaching service.

8. Your Privacy Rights

8.1 Rights for All Users

Regardless of where you live, you have the right to:

• Access your personal information.
• Correct inaccurate personal information.
• Delete your personal information (subject to legal retention requirements).
• Export your data in a commonly used, machine-readable format.
• Withdraw consent for optional data processing activities.
• Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@coachmode.app.

8.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale: We do NOT sell your personal information, so this right does not currently apply. If our practices change, we will provide a “Do Not Sell My Personal Information” link.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information to what is necessary to provide the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Verification: To protect your privacy, we will verify your identity before fulfilling any CCPA request. We may ask you to confirm your email address or provide additional verification through your Coach Mode account.

Authorized Agent: You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization signed by you, and we may verify your identity directly.

Response Timeline: We will respond to verifiable consumer requests within 45 days. If we need more time (up to an additional 45 days), we will notify you of the extension and the reason.

8.3 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your data based on: (a) your consent; (b) the necessity of performing our contract with you (providing the Service); (c) our legitimate interests (security, fraud prevention, service improvement); or (d) compliance with legal obligations.
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Restrict Processing: You may request that we restrict processing of your data in certain circumstances.
• Right to Object: You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.

Data Transfers: If you are located outside the United States, your data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses and other lawful transfer mechanisms to protect your data during international transfers.

8.4 Other State Privacy Laws

We comply with applicable state privacy laws, including but not limited to:

• Virginia Consumer Data Protection Act (VCDPA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• Utah Consumer Privacy Act (UCPA)
• Texas Data Privacy and Security Act (TDPSA)

Residents of these states may exercise similar rights to access, correct, delete, and opt-out of certain data processing. Contact us at privacy@coachmode.app.

9. Data Security

9.1 Security Measures

We implement commercially reasonable technical, administrative, and physical safeguards to protect your personal information, including:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Database records and stored files are encrypted at rest.
• Access Controls: Role-based access controls ensure that users can only access data they are authorized to view. All API routes verify access permissions.
• Pre-signed URLs: Videos are accessed through time-limited pre-signed URLs (15-minute upload, 30-minute read), not through permanent public URLs.
• Input Validation: All user inputs are validated using Zod schemas to prevent injection attacks.
• Rate Limiting: API endpoints are rate-limited to prevent abuse.
• Security Logging: Security-relevant events (unauthorized access attempts, presigned URL generation) are logged for monitoring.
• Sanitized Filenames: Uploaded file names are sanitized to prevent path traversal and injection attacks.

9.2 Limitations

No method of electronic transmission or storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law.

10. Cookies and Tracking Technologies

10.1 What We Use

Coach Mode uses the following cookies and similar technologies:

10.2 What We Do NOT Use

• Advertising cookies or trackers: We do not serve ads and do not use advertising tracking pixels.
• Cross-site tracking: We do not track you across other websites.
• Social media tracking pixels: We do not embed social media tracking on the Platform.

10.3 Managing Cookies

You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using the Service. We honor “Do Not Track” browser signals.

11. Links to Other Websites

The Service may contain links to third-party websites that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites. We encourage you to review the privacy policy of every site you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by:

• Posting the updated Privacy Policy on the Service with a revised “Last Updated” date.
• Sending an email notification to the address associated with your account (for material changes).
• Displaying an in-app notification.

If changes materially affect how we handle children's personal information, we will obtain new verifiable parental consent where required by COPPA. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the updated Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For COPPA-related inquiries or parental rights requests:
Email: privacy@coachmode.app (subject line: “COPPA Request”)

We aim to respond to all privacy inquiries within 30 days.